Privacy Policy

1. Who We Are and How to Contact Us

pop99 ("we," "us," "our," or "the Platform") operates the online gaming and sports betting platform available at pop99.win and through the pop99 mobile application. pop99 is licensed under international gaming authority. For all data-related inquiries, including exercising your rights under this Policy, you may contact our data team at: [email protected]

This Privacy Policy applies to all users who access or register for pop99, including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and all other regions in Malaysia and internationally where pop99 is accessible.

2. Personal Data We Collect

pop99 collects personal data from you directly, automatically through your use of the platform, and in some cases from third parties. The categories of data we collect include:

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile phone number, residential address, and preferred username and password.
• Identity verification (KYC) data: Copies of government-issued photo identification (e.g., MyKad, passport), proof of address documents, and selfie verification images as required to satisfy our licensing obligations.
• Payment data: Bank account details, e-wallet identifiers (Touch 'n Go, Boost), and transaction records sufficient to process deposits and withdrawals and to comply with anti-money laundering requirements. pop99 does not store full card numbers; payment processing is handled by certified payment service providers.
• Support communications: Messages, emails, and chat records submitted to pop99 customer support.
• Responsible gaming preferences: Deposit limits, loss limits, self-exclusion requests, and cooling-off period selections you configure in your account.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: Pages visited, game sessions played, session duration, betting and gaming history, login timestamps, and navigation patterns within the platform.
• Cookies and tracking technologies: As further described in Section 5 of this Policy.
• Geolocation data: Approximate location derived from your IP address for the purpose of regulatory compliance and fraud detection.

2.3 Data from Third Parties

• Identity verification service providers who assist with KYC document authentication.
• Payment processors who provide transaction confirmation and fraud screening data.
• Anti-fraud and risk management platforms that may provide signals about suspicious account or transaction activity.

3. How pop99 Uses Your Personal Data

pop99 uses the personal data it collects for the following purposes:

pop99 does not use your personal data to make fully automated decisions that produce significant legal effects without human oversight.

4. Legal Basis for Processing

pop99 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to provide the services you have registered for — including account management, payments, and gaming access.
• Legal obligation: Processing required to comply with our international gaming licence conditions, anti-money laundering regulations, and other applicable legal requirements, including mandatory KYC and record-keeping obligations.
• Legitimate interests: Processing undertaken to detect and prevent fraud, protect platform security, improve our services, and manage risk — where these interests are not overridden by your fundamental rights.
• Consent: Marketing communications and certain non-essential cookies are processed only where you have given specific, informed consent, which you may withdraw at any time.

5. Cookies and Tracking Technologies

pop99 uses cookies, web beacons, and similar tracking technologies on the platform and mobile app. These serve the following functions:

• Strictly necessary cookies: Required for the platform to function — including authentication tokens, session management, and security features. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, game history display options, and responsible gaming tool configurations.
• Analytics cookies: Collect anonymised usage statistics to help us understand how the platform is used and where improvements are needed. pop99 uses self-hosted analytics rather than third-party tracking services where practicable.
• Marketing cookies: Only set where you have explicitly consented. Used to measure the effectiveness of promotional campaigns and personalise offer communications.

You can manage non-essential cookie preferences through your account settings or your browser's cookie management tools. Disabling certain cookies may affect the functionality of some platform features.

6. Data Sharing and Disclosure

pop99 does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. pop99 shares your data only in the following circumstances:

• Service providers: Trusted third-party vendors who assist in operating pop99 — including KYC verification providers, payment processors, fraud screening services, cloud infrastructure providers, and game studios. All service providers are bound by data processing agreements requiring them to handle your data only as instructed and with appropriate security measures.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory directive, pop99 will disclose data to competent authorities. This includes mandatory reporting obligations under our gaming licence.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of pop99's assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
• With your consent: pop99 will not share your data for any other purpose without your explicit prior consent.

7. Data Retention

pop99 retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory requirements. Specific retention periods include:

• Account and KYC data is retained for a minimum of five (5) years following account closure, as required by anti-money laundering regulations applicable to our gaming licence.
• Transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Responsible gaming records, including self-exclusion history, are retained for a minimum of five (5) years to prevent re-registration during an exclusion period.
• Customer support communications are retained for three (3) years from the date of the interaction.
• Marketing consent records are retained for as long as the consent is active and for two (2) years following withdrawal of consent.

Upon expiry of applicable retention periods, pop99 will securely delete or anonymise your personal data in accordance with our internal data lifecycle procedures.

8. Security Measures

pop99 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and pop99 servers.
• Encryption of sensitive data fields at rest, including payment credentials and identification documents.
• Role-based access controls limiting employee access to personal data to those with a documented operational need.
• Regular security assessments and penetration testing of platform infrastructure.
• Incident response procedures for detecting, reporting, and responding to data security incidents.

While pop99 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your pop99 login credentials and for using a secure, private network connection when accessing the platform — particularly relevant for players in Kuala Lumpur, Penang, and other urban centres where public Wi-Fi networks are common.

9. Your Privacy Rights

Subject to applicable law and our regulatory obligations, you have the following rights in relation to your personal data held by pop99:

• Right of access: Request a copy of the personal data pop99 holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purposes collected, subject to our legal retention obligations.
• Right to restrict processing: Request that we limit processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format where processing is based on consent or contractual necessity.
• Right to withdraw consent: Withdraw consent for marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.
• Right to object: Object to processing based on legitimate interests where you believe your rights and freedoms override those interests.

To exercise any of these rights, contact pop99 at [email protected]. We will respond within thirty (30) days. We may need to verify your identity before processing your request.

10. Children's Privacy

pop99 is strictly a 21+ platform. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by a person under 21, that account will be immediately closed, any balance forfeited, and all associated personal data deleted or retained only to the extent required to prevent re-registration. If you believe a minor has accessed pop99, please notify us immediately at [email protected].

11. International Data Transfers

pop99 operates infrastructure that may involve the transfer of personal data to countries outside Malaysia. Where such transfers occur, pop99 ensures that appropriate safeguards are in place — including data processing agreements incorporating standard contractual clauses, or transfers to jurisdictions that provide an adequate level of data protection. The use of KYC verification and payment processing service providers may involve data transfers to their respective infrastructure locations; all such transfers are governed by contractual data protection obligations.

12. Updates to This Privacy Policy

pop99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. Where material changes are made, pop99 will notify registered users via platform notification or email to the registered address. The current version of this Policy, together with its effective date, is always accessible at pop99.win/privacy-policy. Continued use of the platform after the effective date of any revision constitutes your acceptance of the updated Policy.